🔒 Security release
This release upgrades Next.js from 16.3.0 to 16.3.3 to address the August 2026 Next.js security release. We recommend all self-hosted instances upgrade promptly.
The headline fix is a critical severity vulnerability in the image optimization pipeline (GHSA-2xp9-vwfh-vxw4): a bug in the libheif library used by sharp can lead to unauthenticated remote code execution when the server optimizes a malicious AVIF image. Next.js 16.3.3 disables AVIF optimization until a fixed libheif propagates upstream.
Rallly's default configuration does not allow the image optimizer to fetch remote URLs, which narrows the practical attack surface, but given the severity we recommend upgrading rather than relying on that.
The second advisory in the release (CVE-2026-75604) only affects Windows hosted servers that combine the Pages Router and App Router. Rallly uses the App Router exclusively and ships as a Linux container, so it is not affected.
Note
There are no configuration or database changes, and no migrations ship in this release. Rallly Cloud was patched separately and is not affected as of this release.
What's Changed
- ⬆️ Upgrade Next.js to 16.3.3 for the August 2026 security release (#3073)
Full Changelog: v4.13.0...v4.13.1